{"cve":"CVE-2018-1447","nvd":{"published":"2018-04-04T18:29:02.293","modified":"2026-06-17T01:51:14.880","status":"Modified","description":"The GSKit (IBM Spectrum Protect 7.1 and 7.2) and (IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6) CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak password may be recovered. Note: After update the customer should change password to ensure the new password is stored more securely. Products should encourage customers to take this step as a high priority action. IBM X-Force ID: 139972.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1},"cwes":["CWE-916"],"references":["http://www.ibm.com/support/docview.wss?uid=swg22014669","http://www.ibm.com/support/docview.wss?uid=swg22014957","http://www.ibm.com/support/docview.wss?uid=swg22015066","http://www.ibm.com/support/docview.wss?uid=swg22015071","http://www.securityfocus.com/bid/104511"],"products":["ibm:spectrum_protect_for_space_management","ibm:spectrum_protect_for_virtual_environments","ibm:spectrum_protect_snapshot"],"source":"nvd","synced_at":"2026-10-19T20:49:59.483420567+00:00"},"epss":{"cve":"CVE-2018-1447","score":0.00913,"percentile":0.60082,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}